@clear-capabilities/agentic-security-scanner 0.136.2 → 0.137.0

package/bin/agentic-security.js

@@ -14,7 +14,6 @@ import { toCycloneDX, toSPDX } from '../src/posture/sbom.js';
 import { toPBOM } from '../src/sast/pipeline.js';
 import { buildAIBOM, aibomToMarkdown } from '../src/posture/aibom.js';
 import { recordScan, formatStreakLine, formatGradeDelta } from '../src/posture/streak.js';
-import { ingestAndMerge } from '../src/sca/sarif-ingest.js';
 import { loadProfile, saveProfile, detectProfile, renderAttributionLine, ATTRIBUTION, ATTRIBUTION_URL } from '../src/posture/profile.js';
 import { applySuppressions, addSoftAcceptance, expiredSoftAcceptances } from '../src/posture/suppressions.js';
 import { applyOverrides, validateOverrides, suppressionReport, renderSuppressionSummary } from '../src/posture/rule-overrides.js';
@@ -28,7 +27,6 @@ import { syncTickets } from '../src/integrations/tickets.js';
 import { decide as decideNextAction, explain as explainDecision } from '../src/posture/router.js';
 import * as triage from '../src/posture/triage.js';
 import { buildSlackDigest, buildDiscordDigest, postWebhook, buildJiraIssue, buildPrComment, buildSiemEvent, loadIntegrationConfig } from '../src/integrations/index.js';
-import { globFiles } from '../src/util/glob.js';
 
 import { stateDir, statePath } from '../src/posture/state-dir.js';
 // last-scan.json integrity helpers — implementation in posture/integrity.js
@@ -111,7 +109,6 @@ Options:
   --show-threat-model          Append the auto-derived STRIDE threat model summary
   --show-drift                 Append calibration-drift alarms (overconfidence detection)
   --sca-reachable-only         Only SCA findings where the vulnerable function is reachable
-  --ingest-sarif <glob>        Merge external SARIF into this scan
   --scorecard                  Enrich components with OSSF Scorecard scores
   --no-network                 Skip OSV/registry queries (offline mode)
   --pr [ref]                   Diff-aware: scan only files changed since ref (auto-detects PR base)
@@ -297,7 +294,7 @@ function _bundleSha() {
   return 'unavailable';
 }
 
-async function writeMachineOutput(targetAbs, scan, meta, profile) {
+async function writeMachineOutput(targetAbs, scan, meta, profile, args) {
   const stateDirPath = stateDir(targetAbs);
   const { isSafeStateDir: _isSafe, stateWritesEnabled: _writesOn } = await import('../src/posture/state-dir.js');
   // Read-only scan (NON_MUTATING_SCAN_PRD S1). These writes bypass
@@ -311,7 +308,7 @@ async function writeMachineOutput(targetAbs, scan, meta, profile) {
   // Always JSON (used by /security-fix and /security-report).
   await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
     JSON.stringify(toJSON(scan, meta), null, 2));
-  if (profile.profile === 'pro' || profile.machineOutput) {
+  if (profile.profile === 'pro' || profile.machineOutput || (args && args.flags['machine-output'])) {
     await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
       JSON.stringify(toSARIF(scan, meta), null, 2));
     await fsp.writeFile(path.join(stateDirPath, 'findings.csv'), toCSV(scan));
@@ -436,13 +433,23 @@ async function cmdScan(args) {
       if (process.stderr.isTTY) process.stderr.write(`\r[${p.phase}] ${p.current}/${p.total} ${p.file}     `);
     },
   });
+  // The BOM/attestation emitters stamp the producing engine's version into
+  // their metadata; carry the real package version so it can never drift.
+  if (meta && meta.engineVersion == null) meta.engineVersion = PKG_VERSION;
   if (process.stderr.isTTY) process.stderr.write('\r' + ' '.repeat(80) + '\r');
 
   const only = args.flags.only;
   if (only) {
+    // Four channels exist (scanner/CLAUDE.md): findings (SAST), secrets,
+    // supplyChain (SCA), logicVulns (business-logic). --only sast keeps
+    // logicVulns (business-logic is source analysis, part of the SAST
+    // pillar); --only sca/secrets must also clear it — it's neither SCA
+    // nor secrets, and normalizeFindings()/exitCodeFor() both fold it in,
+    // so leaving it meant a business-logic finding leaked into a
+    // single-pillar scan's output AND its exit code.
     if (only === 'sast') { scan.secrets = []; scan.supplyChain = []; }
-    if (only === 'sca')  { scan.findings = []; scan.secrets = []; }
-    if (only === 'secrets') { scan.findings = []; scan.supplyChain = []; }
+    if (only === 'sca')  { scan.findings = []; scan.secrets = []; scan.logicVulns = []; }
+    if (only === 'secrets') { scan.findings = []; scan.supplyChain = []; scan.logicVulns = []; }
   }
 
   // --set-baseline: save current findings as baseline for future --since-baseline filtering
@@ -494,18 +501,6 @@ async function cmdScan(args) {
   // 0.9.0 Feat-18: --scorecard flag enables OSSF Scorecard enrichment
   if (args.flags['scorecard']) process.env.AGENTIC_SECURITY_SCORECARD = '1';
 
-  // 0.7.0 Feat-7: --ingest-sarif <path-or-glob> merges SARIF from external tools (Semgrep,
-  // gitleaks, Bandit, Trivy, Checkov, etc.) into this scan's findings, deduping by
-  // fingerprint and tracking provenance via sources[].
-  if (args.flags['ingest-sarif']) {
-    const glob = args.flags['ingest-sarif'];
-    const paths = await globFiles(glob);
-    if (paths.length) {
-      const r = ingestAndMerge(scan, paths);
-      if (process.stderr.isTTY) process.stderr.write(`[ingest] merged ${r.merged} / added ${r.added} findings from ${paths.length} SARIF file(s)\n`);
-    }
-  }
-
   // 0.6.0 Feat-1: --sca-reachable-only filters to only SCA findings where the vulnerable
   // function was confirmed reachable from a route handler.
   if (args.flags['sca-reachable-only']) {
@@ -566,6 +561,31 @@ async function cmdScan(args) {
     try { await enrichWithEPSS(scan); } catch {}
   }
 
+  // Re-run risk-dollars now that both signals it needs are actually
+  // available: EPSS (just enriched above — engine.js's own call ran before
+  // this, so every finding's epssScore was still unset) and relevanceTier
+  // (posture/relevance.js runs last inside runScan/engine.js, so it's
+  // populated on `scan.findings` by the time we get here, but wasn't yet
+  // when engine.js's own annotateRiskDollars call ran mid-pipeline).
+  try {
+    const { annotateRiskDollars } = await import('../src/posture/risk-dollars.js');
+    annotateRiskDollars(targetAbs, scan.findings || []);
+  } catch {}
+
+  // Re-run composite risk for the same reason as annotateRiskDollars above:
+  // engine.js's mid-pipeline annotateCompositeRisk calls ran before
+  // enrichWithEPSS (just above) had a chance to set f.exploitedNow, so
+  // every finding's 'exploited-now-floor:75' boost was computed against a
+  // field that was always undefined at the time — an actively-exploited
+  // CVE (EPSS percentile >= 0.95) never got its compositeRisk score raised.
+  // annotateCompositeRisk is pure/idempotent (only sets compositeRisk*
+  // fields, reads everything else), so re-running it here is safe.
+  try {
+    const { annotateCompositeRisk } = await import('../src/posture/composite-risk.js');
+    annotateCompositeRisk(scan.findings || []);
+    annotateCompositeRisk(scan.supplyChain || []);
+  } catch {}
+
   // Blast-radius narrative — purely local, always safe to run.
   if (!args.flags['no-blast-radius']) {
     try { enrichWithBlastRadius(scan, targetAbs); } catch {}
@@ -622,7 +642,7 @@ async function cmdScan(args) {
   } catch { /* attestation is metadata; never fail a scan over it */ }
 
   // R2: Always emit machine-readable artifacts to .agentic-security/.
-  await writeMachineOutput(targetAbs, scan, meta, profile);
+  await writeMachineOutput(targetAbs, scan, meta, profile, args);
 
   const includeSuppressed = !!args.flags['include-suppressed'];
   let body;
@@ -664,32 +684,70 @@ async function cmdScan(args) {
   // Persist last scan for /security-fix and /security-report
   const { isSafeStateDir: _isSafeStateDir, stateWritesEnabled: _writesOnScan } = await import('../src/posture/state-dir.js');
   const stateDirPath = stateDir(path.resolve(target));
+  // S7 (Stage-0 audit): declared here, not with `const` inside the `if`
+  // below — it used to be block-scoped there while recordScan() further
+  // down referenced it unconditionally, throwing a ReferenceError on every
+  // single scan (silently swallowed by that call's empty catch{}). streak.json
+  // — grades, streak days, achievements — never actually persisted through
+  // the real CLI as a result, reproduced live before this fix.
+  let persistedScan = null;
   if (_writesOnScan() && _isSafeStateDir(stateDirPath)) {
     await fsp.mkdir(stateDirPath, { recursive: true });
-    const persistedScan = toJSON(scan, meta);
+    persistedScan = toJSON(scan, meta);
     // #10 — MTTR: stamp firstSeenAt/lastSeenAt/ageDays from the PREVIOUS scan so
     // every finding carries an age, SLA breaches can be surfaced, and the fix
     // loop can report time-to-clean. Best-effort; skipped under --deterministic
     // so deterministic state stays byte-identical run-to-run.
     if (!args.flags.deterministic) {
       try {
-        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary } = await import('../src/posture/mttr.js');
+        const { stampFindingTimestamps, buildBaselineMap, renderSlaSummary, fingerprintFinding, computeMTTR } = await import('../src/posture/mttr.js');
         let baselineMap = new Map();
+        let prevAll = [];
         try {
           const prev = JSON.parse(await fsp.readFile(path.join(stateDirPath, 'last-scan.json'), 'utf8'));
           baselineMap = buildBaselineMap(prev);
+          // The previous scan's own findings already carry firstSeenAt/lastSeenAt
+          // from ITS baseline lookup — exactly the shape computeMTTR needs for
+          // whichever of them are no longer present now (i.e. were fixed).
+          prevAll = [
+            ...(prev?.findings || []), ...(prev?.secrets || []),
+            ...(prev?.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+          ];
         } catch { /* first run — empty baseline, everything is firstSeen now */ }
         const now = Date.now();
         stampFindingTimestamps(persistedScan.findings || [], baselineMap, now);
         stampFindingTimestamps(persistedScan.secrets || [], baselineMap, now);
         stampFindingTimestamps((persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'), baselineMap, now);
+        // #10 — MTTR: which of the previous scan's findings are no longer
+        // present now (fixed), and how long each took. computeMTTR itself was
+        // fully built and tested but had never had a real caller — the module's
+        // own comment calls it "true MTTR," distinct from the open-backlog
+        // median-age proxy renderSlaSummary already surfaces below.
+        const currentFps = new Set([
+          ...(persistedScan.findings || []), ...(persistedScan.secrets || []),
+          ...(persistedScan.supplyChain || []).filter(s => s.type === 'vulnerable_dep'),
+        ].map(fingerprintFinding));
+        const removed = prevAll.filter(f => !currentFps.has(fingerprintFinding(f)));
+        persistedScan.mttr = computeMTTR(removed);
         // Surface the SLA-breach line on human-readable formats (not JSON/CI pipes).
         const isJson = format === 'json' || format === 'sarif' || format === 'cyclonedx' || format === 'sbom' || format === 'spdx' || format === 'vex' || format === 'openvex' || format === 'pbom' || format === 'aibom';
         if (!isJson) {
           const sla = renderSlaSummary(persistedScan.findings || []);
           if (sla) process.stderr.write(`⏰ agentic-security: ${sla}\n`);
+          if (persistedScan.mttr.count > 0) {
+            process.stderr.write(`✅ agentic-security: ${persistedScan.mttr.count} finding(s) fixed since last scan, median ${Math.round(persistedScan.mttr.medianDays)}d to remediate\n`);
+          }
         }
-      } catch { /* MTTR is best-effort — never block a scan write */ }
+      } catch (e) {
+        // MTTR is best-effort — never block a scan write. But a silent catch
+        // here previously hid a real, deterministic CI-only failure (the
+        // mttr field went missing on every hosted-CI run, never locally, and
+        // nothing explained why) for long enough that it shipped several
+        // releases undiagnosed. Surface it — never fail the scan on it.
+        if (process.env.AGENTIC_SECURITY_MTTR_DEBUG === '1' || process.env.CI || process.env.GITHUB_ACTIONS) {
+          process.stderr.write(`agentic-security: MTTR computation failed (best-effort, scan unaffected): ${(e && e.stack) || e}\n`);
+        }
+      }
 
       // R5 — report the observed time-to-validated-fix distribution from the
       // fix attempts recorded by `verifyFix`. This is measurement, not
@@ -735,10 +793,17 @@ async function cmdScan(args) {
 
   // 0.14.0 — update streak / achievements after every full scan. Suppress
   // streak side effects when the user only wants raw JSON output (CI piping).
+  // Gated on `persistedScan !== null` (i.e. the same _writesOnScan() &&
+  // _isSafeStateDir() condition above) — recordScan()'s own isSafeStateDir
+  // check alone does not know about --no-state / AGENTIC_SECURITY_NO_STATE,
+  // so without this a "read-only, mutates nothing" scan would still write
+  // streak.json. This was accidentally masked before the persistedScan
+  // scoping fix (recordScan was never reached at all, for the wrong reason);
+  // fixing that reachability bug required adding this guard explicitly.
   try {
-    const streak = recordScan(stateDirPath, persistedScan);
+    const streak = persistedScan !== null ? recordScan(stateDirPath, persistedScan) : null;
     // Print celebration / streak line to stderr so it doesn't pollute --format json
-    if (process.stderr.isTTY && format !== 'json' && format !== 'sarif') {
+    if (streak && process.stderr.isTTY && format !== 'json' && format !== 'sarif') {
       const delta = formatGradeDelta(streak);
       const line = formatStreakLine(streak);
       if (delta) process.stderr.write('\n' + delta + '\n');
@@ -814,20 +879,48 @@ async function cmdCi(args) {
   const packNames = packArg ? (Array.isArray(packArg) ? packArg : String(packArg).split(',')) : [];
   if (packNames.length) Object.assign(scan, applyPacks(scan, packNames));
 
-  // Persist the three CI artifacts.
+  // R4 — same run attestation cmdScan attaches, computed here too so
+  // findings.json (the actual CI evidence artifact) carries the same
+  // tamper-evidence digest 'agentic-security scan' does, rather than
+  // always shipping attestation: null. Runs after every filter above, so
+  // it attests what actually ships. Metadata only — never fails the scan.
+  try {
+    const { computeRunAttestation } = await import('../src/posture/attestation.js');
+    const { keyProvenance } = await import('../src/posture/integrity.js');
+    const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
+    scan.attestation = computeRunAttestation({
+      findings: normalizeFindings(scan),
+      engineVersion: PKG_VERSION,
+      rulesetVersion: effectiveVersion(targetAbs).version,
+      bundleSha: _bundleSha(),
+      root: targetAbs,
+      sign: true,
+    });
+    if (scan.attestation) scan.attestation.keyProvenance = keyProvenance();
+  } catch { /* attestation is metadata; never fail a scan over it */ }
+
+  // Persist the three CI artifacts — but a refusal to write must NEVER skip
+  // the --fail-on evaluation below. S1 (Stage-0 audit, 2026): this used to be
+  // a bare `return;` inside the write-guard, so `cmdCi` returned `undefined`
+  // and `process.exit(await cmdCi(args))` became `process.exit(undefined)`,
+  // which Node treats as exit 0 — a CI pipeline reading only $? would see a
+  // passing build whose findings were never evaluated against --fail-on at
+  // all. The write and the gate are orthogonal: "we couldn't persist
+  // artifacts" is not evidence about "the scan is clean."
   const stateDirPath = stateDir(targetAbs);
   const { isSafeStateDir: _isSafeCi, stateWritesEnabled: _writesOnCi } = await import('../src/posture/state-dir.js');
-  if (!_writesOnCi() || !_isSafeCi(stateDirPath)) {
+  const _canWriteCi = _writesOnCi() && _isSafeCi(stateDirPath);
+  if (!_canWriteCi) {
     if (process.env.AGENTIC_SECURITY_DEBUG === '1') process.stderr.write(`[agentic-security] refusing to write CI artifacts at ${stateDirPath} — no project marker\n`);
-    return;
+  } else {
+    await fsp.mkdir(stateDirPath, { recursive: true });
+    await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
+      JSON.stringify(toJSON(scan, meta), null, 2));
+    await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
+      JSON.stringify(toSARIF(scan, meta), null, 2));
+    await fsp.writeFile(path.join(stateDirPath, 'findings.junit.xml'),
+      toJUnit(scan, meta));
   }
-  await fsp.mkdir(stateDirPath, { recursive: true });
-  await fsp.writeFile(path.join(stateDirPath, 'findings.json'),
-    JSON.stringify(toJSON(scan, meta), null, 2));
-  await fsp.writeFile(path.join(stateDirPath, 'findings.sarif'),
-    JSON.stringify(toSARIF(scan, meta), null, 2));
-  await fsp.writeFile(path.join(stateDirPath, 'findings.junit.xml'),
-    toJUnit(scan, meta));
 
   const scanCode = exitCodeFor(scan);
   const findings = normalizeFindings(scan);
@@ -835,7 +928,9 @@ async function cmdCi(args) {
   for (const f of findings) sev[f.severity] = (sev[f.severity] || 0) + 1;
   process.stderr.write(
     `[ci] ${findings.length} findings — ${sev.critical} critical · ${sev.high} high · ${sev.medium} medium · ${sev.low} low\n` +
-    `[ci] artifacts: .agentic-security/findings.{json,sarif,junit.xml}\n` +
+    (_canWriteCi
+      ? `[ci] artifacts: .agentic-security/findings.{json,sarif,junit.xml}\n`
+      : `[ci] artifacts: NOT written (state writes refused — set AGENTIC_SECURITY_DEBUG=1 for the reason)\n`) +
     `[ci] fail-on=${failOn}  scan-exit=${scanCode}\n`
   );
   // FR-SDLC-9: when --policy <file.rego> is supplied, evaluate against the
@@ -1758,16 +1853,73 @@ async function cmdAttest(args) {
   return 0;
 }
 
+// R4/D2 correctness follow-up: attestation.js ships TWO independent
+// verifiers — verifyEvidenceBundle (per-finding, Ed25519, self-contained —
+// only needs a public key) and verifyRunAttestation (whole-run, per-install
+// HMAC, NOT self-contained — needs the caller to also supply the finding
+// set to re-derive against). This CLI command only ever called the first;
+// the second had zero production callers anywhere in the repo (confirmed by
+// grep — only test/attestation.test.js called it). Auto-detect which
+// artifact was handed in and dispatch to the matching verifier instead of
+// silently misinterpreting a run-attestation as a (structurally different)
+// evidence bundle.
+function _asRunAttestation(obj) {
+  if (obj && typeof obj.digest === 'string' && obj.canonicalisation) return obj;
+  if (obj && obj.attestation && typeof obj.attestation.digest === 'string') return obj.attestation;
+  return null;
+}
+
+// Verifies a run attestation the ONLY way it can be verified: by re-deriving
+// the digest from a fresh scan and comparing. Unlike an evidence bundle
+// (self-contained, just needs a public key), a run attestation is a claim
+// about a FINDING SET, not a standalone signed blob — "does scanning this
+// codebase right now reproduce the exact digest an earlier run attested"
+// is the actual, meaningful question this command answers.
+async function cmdVerifyRunAttestation(attestation, args) {
+  const projectPath = path.resolve(args.flags.against || '.');
+  if (!fs.existsSync(projectPath)) {
+    console.error(`--against path does not exist: ${projectPath}`);
+    return 2;
+  }
+  console.log(`Re-scanning ${projectPath} to check it reproduces the attested digest...`);
+  const { runScan } = await import('../src/runScan.js');
+  const { normalizeFindings } = await import('../src/report/index.js');
+  const { effectiveVersion } = await import('../src/posture/ruleset-version.js');
+  const { verifyRunAttestation } = await import('../src/posture/attestation.js');
+  const { scan } = await runScan(projectPath);
+  const r = verifyRunAttestation(attestation, {
+    findings: normalizeFindings(scan),
+    engineVersion: PKG_VERSION,
+    rulesetVersion: effectiveVersion(projectPath).version,
+    bundleSha: _bundleSha(),
+    root: projectPath,
+  });
+  if (!r.ok) {
+    console.error(`✗ INVALID — ${r.reason}`);
+    return 1;
+  }
+  console.log('✓ VALID — a fresh scan of this project reproduces the attested digest exactly.');
+  console.log('');
+  console.log(`  digest:          ${attestation.digest}`);
+  console.log(`  findingCount:    ${attestation.findingCount}`);
+  console.log(`  proves:          ${attestation.proves}`);
+  console.log(`  does NOT prove:  ${attestation.doesNotProve}`);
+  return 0;
+}
+
 async function cmdVerifyAttestation(args) {
   const { verifyEvidenceBundle, keyPaths } = await import('../src/posture/evidence-bundle.js');
   // `args._[0]` is the command name itself — the same convention cmdScan uses.
   const file = args.flags.bundle || args._[1];
-  if (!file) { console.error('Usage: agentic-security verify-attestation <bundle.json> [--public-key <path>]'); return 2; }
+  if (!file) { console.error('Usage: agentic-security verify-attestation <bundle.json|last-scan.json> [--public-key <path>] [--against <project-path>]'); return 2; }
 
   let bundle;
   try { bundle = JSON.parse(fs.readFileSync(path.resolve(file), 'utf8')); }
   catch (e) { console.error(`Could not read bundle: ${e.message}`); return 2; }
 
+  const runAttestation = _asRunAttestation(bundle);
+  if (runAttestation) return cmdVerifyRunAttestation(runAttestation, args);
+
   const keyFile = args.flags['public-key'] || keyPaths().publicKey;
   let publicKeyPem = null;
   try { publicKeyPem = fs.readFileSync(path.resolve(keyFile), 'utf8'); }

package/dist/113.index.js

@@ -78,7 +78,7 @@ function recordFixAttempt(scanRoot, record) {
   try {
     const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
   node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.
@@ -266,7 +266,16 @@ function _detectRunner(scanRoot) {
     } catch { return null; }
   })();
   if (pkg && pkg.scripts && pkg.scripts.test && !/no test specified/.test(String(pkg.scripts.test))) {
-    return { runner: 'npm', cmd: 'npm', args: ['test', '--silent', '--', '--passWithNoTests'] };
+    // --passWithNoTests is Jest-specific CLI syntax — appending it
+    // unconditionally broke every non-Jest npm test script (mocha, vitest,
+    // ava, tap, or a plain node script) with an "unrecognized option" exit,
+    // failing verification for a reason that has nothing to do with
+    // whether the patch actually broke anything. Only add it when Jest is
+    // actually the configured runner.
+    const usesJest = /\bjest\b/.test(String(pkg.scripts.test))
+      || Boolean(pkg.devDependencies?.jest) || Boolean(pkg.dependencies?.jest);
+    const args = usesJest ? ['test', '--silent', '--', '--passWithNoTests'] : ['test', '--silent'];
+    return { runner: 'npm', cmd: 'npm', args };
   }
   if (has('pytest.ini') || has('pyproject.toml') || has('setup.cfg')) {
     return { runner: 'pytest', cmd: 'pytest', args: ['-q', '--no-header', '-x'] };
@@ -406,8 +415,8 @@ var external_node_child_process_ = __webpack_require__(1421);
 var external_node_fs_ = __webpack_require__(3024);
 // EXTERNAL MODULE: external "node:path"
 var external_node_path_ = __webpack_require__(6760);
-// EXTERNAL MODULE: ./src/engine.js + 499 modules
-var engine = __webpack_require__(2912);
+// EXTERNAL MODULE: ./src/engine.js + 196 modules
+var engine = __webpack_require__(2739);
 ;// CONCATENATED MODULE: ./src/posture/fix-honesty-gate.js
 // Deterministic honesty gates on fix / finding output (#7).
 //

package/dist/178.index.js

@@ -13,7 +13,7 @@ export const modules = {
 /* harmony import */ var node_child_process__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(1421);
 /* harmony import */ var node_fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(3024);
 /* harmony import */ var node_path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6760);
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2912);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(2739);
 // Time-travel + counterfactual scanning (v0.68).
 //
 // Two new modes that exploit the pure-input shape of runFullScan:

package/dist/207.index.js

@@ -6,9 +6,10 @@ export const modules = {
 /***/ ((__unused_webpack___webpack_module__, __webpack_exports__, __webpack_require__) => {
 
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
-/* harmony export */   computeRunAttestation: () => (/* binding */ computeRunAttestation)
+/* harmony export */   computeRunAttestation: () => (/* binding */ computeRunAttestation),
+/* harmony export */   verifyRunAttestation: () => (/* binding */ verifyRunAttestation)
 /* harmony export */ });
-/* unused harmony exports ATTESTATION_CANONICALISATION, verifyRunAttestation */
+/* unused harmony export ATTESTATION_CANONICALISATION */
 /* harmony import */ var node_crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(7598);
 /* harmony import */ var _integrity_js__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(1130);
 // R4 — determinism as a contract.
@@ -202,11 +203,11 @@ function verifyRunAttestation(attestation, inputs = {}) {
   }
   if (attestation.signature) {
     let expected;
-    try { expected = signLastScan(attestation.digest); }
+    try { expected = (0,_integrity_js__WEBPACK_IMPORTED_MODULE_1__/* .signLastScan */ .lU)(attestation.digest); }
     catch { return { ok: false, reason: 'signature present but no key material available to check it' }; }
     const a = Buffer.from(String(attestation.signature), 'hex');
     const b = Buffer.from(expected, 'hex');
-    if (a.length !== b.length || !crypto.timingSafeEqual(a, b)) {
+    if (a.length !== b.length || !node_crypto__WEBPACK_IMPORTED_MODULE_0__.timingSafeEqual(a, b)) {
       return { ok: false, reason: 'signature does not verify under this install key' };
     }
     return { ok: true, reason: 'digest and per-install signature verify' };

package/dist/238.index.js

@@ -78,7 +78,7 @@ function recordFixAttempt(scanRoot, record) {
   try {
     const dir = (0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__/* .stateDir */ .Pn)(scanRoot);
     if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.isSafeStateDir)(dir)) return false;
-    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return;
+    if (!(0,_state_dir_js__WEBPACK_IMPORTED_MODULE_2__.stateWritesEnabled)()) return false;
   node_fs__WEBPACK_IMPORTED_MODULE_0__.mkdirSync(dir, { recursive: true });
     // One writeSync of one newline-terminated line: a concurrent reader sees
     // whole records or nothing, and a torn tail is dropped on read.

package/dist/317.index.js

@@ -123,12 +123,25 @@ function ensureKeyPair(dir = keyDir()) {
     return { privateKeyPem, publicKeyPem, created: true, ...p };
   } catch (e) {
     if (e.code !== 'EEXIST') throw e;
-    return {
-      privateKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8'),
-      publicKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8'),
-      created: false,
-      ...p,
-    };
+    // We lost the race on the private key — someone else's 'wx' won.
+    // Their public-key write follows immediately after their private-key
+    // write but is not itself atomic with it, so it may not have landed
+    // yet: a bare read here would throw an uncaught ENOENT on a genuinely
+    // transient state, not a real error. Retry briefly rather than crash.
+    const sleepBuf = new Int32Array(new SharedArrayBuffer(4));
+    for (let attempt = 0; ; attempt++) {
+      try {
+        return {
+          privateKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.privateKey, 'utf8'),
+          publicKeyPem: node_fs__WEBPACK_IMPORTED_MODULE_0__.readFileSync(p.publicKey, 'utf8'),
+          created: false,
+          ...p,
+        };
+      } catch (readErr) {
+        if (readErr.code !== 'ENOENT' || attempt >= 50) throw readErr;
+        Atomics.wait(sleepBuf, 0, 0, 10); // 10ms; ~500ms total budget
+      }
+    }
   }
 }
 
@@ -246,9 +259,26 @@ function signEvidenceBundle(bundle, privateKeyPem) {
  * Returns {ok, reason}. Never throws — a malformed bundle from an untrusted
  * source is an expected input, not an exceptional one.
  */
+// The complete set of top-level keys a legitimately-built, signed bundle can
+// carry — buildEvidenceBundle's six plus signEvidenceBundle's `signature`.
+// EA-03 (Stage-0 audit, 2026): canonicalBytes SIGNS an allowlist of fields;
+// verifyEvidenceBundle never checked for keys OUTSIDE that allowlist, so a
+// bundle with a fabricated `verdict`/`proofLevel`/anything-else stapled on
+// after signing verified as authentic — the signature simply never covered
+// those bytes. Rejecting unknown keys here closes that; it must exactly match
+// what buildEvidenceBundle+signEvidenceBundle actually produce, or a
+// legitimate bundle would start failing verification.
+const BUNDLE_TOP_LEVEL_KEYS = new Set([
+  'schema', 'finding', 'evidence', 'engine', 'proves', 'doesNotProve', 'signature',
+]);
+
 function verifyEvidenceBundle(bundle, publicKeyPem) {
   if (!bundle || typeof bundle !== 'object') return { ok: false, reason: 'bundle is not an object' };
   if (bundle.schema !== BUNDLE_SCHEMA) return { ok: false, reason: `unrecognised schema: ${bundle.schema}` };
+  const unknownKeys = Object.keys(bundle).filter(k => !BUNDLE_TOP_LEVEL_KEYS.has(k));
+  if (unknownKeys.length) {
+    return { ok: false, reason: `unrecognised top-level key(s) not covered by the signature: ${unknownKeys.join(', ')}` };
+  }
   const sig = bundle.signature;
   if (!sig?.value) return { ok: false, reason: 'bundle is unsigned' };
   if (sig.algorithm !== 'ed25519') return { ok: false, reason: `unsupported algorithm: ${sig.algorithm}` };

package/dist/384.index.js

@@ -8,7 +8,7 @@ export const modules = {
 /* harmony export */ __webpack_require__.d(__webpack_exports__, {
 /* harmony export */   scanCredentials: () => (/* reexport safe */ _engine_js__WEBPACK_IMPORTED_MODULE_0__.Sv)
 /* harmony export */ });
-/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2912);
+/* harmony import */ var _engine_js__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(2739);
 // Secrets submodule view of the engine — credential + entropy + TODO scanning.